xiongyuxing/gongxue-base
1
0
Fork 0
forked from wangziqi/gongxue-base
Code Pull Requests Activity

feat: add supabase jwt auth context

Browse Source
This commit is contained in:
Codex
2026-06-29 00:17:29 +08:00
parent fbcfa5127e
commit 9553836ac7
20 changed files with 452 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
apps/api/src/core/config.ts
View File

@@ -11,6 +11,10 @@ export interface ApiConfig {
authCodePepper: string;
authSessionSecret: string;
authSmsProvider: string;
authJwtIssuer: string;
authJwtAudience: string;
authJwtSecret: string;
authJwtJwksUrl: string;
authCodeTtlSeconds: number;
authSmsCooldownSeconds: number;
authSessionTtlSeconds: number;
@@ -44,6 +48,7 @@ loadDotenv();
const DEFAULT_AUTH_CODE_PEPPER = 'development-code-pepper-change-me';
const DEFAULT_AUTH_SESSION_SECRET = 'development-session-secret-change-me';
const DEFAULT_AUTH_JWT_SECRET = 'development-jwt-secret-change-me';
const DEFAULT_PLATFORM_ADMIN_API_KEY = 'local-platform-admin-key';
const DEFAULT_MAX_JSON_BODY_BYTES = 1024 * 1024;
const DEFAULT_MAX_IMPORT_JSON_BODY_BYTES = 10 * 1024 * 1024;
@@ -78,6 +83,9 @@ function validateProductionConfig(nextConfig: ApiConfig) {
if (isUnsafeSecret(nextConfig.authSessionSecret, DEFAULT_AUTH_SESSION_SECRET)) {
failures.push('AUTH_SESSION_SECRET must be a strong production secret');
}
if (!nextConfig.authJwtJwksUrl && isUnsafeSecret(nextConfig.authJwtSecret, DEFAULT_AUTH_JWT_SECRET)) {
failures.push('AUTH_JWT_SECRET or AUTH_JWT_JWKS_URL must be configured for production JWT verification');
}
if (isUnsafeSecret(nextConfig.platformAdminApiKey, DEFAULT_PLATFORM_ADMIN_API_KEY)) {
failures.push('PLATFORM_ADMIN_API_KEY must be a strong production secret until platform JWT is implemented');
}
@@ -107,6 +115,10 @@ const loadedConfig: ApiConfig = {
authCodePepper: envString('AUTH_CODE_PEPPER', DEFAULT_AUTH_CODE_PEPPER),
authSessionSecret: envString('AUTH_SESSION_SECRET', DEFAULT_AUTH_SESSION_SECRET),
authSmsProvider: envString('AUTH_SMS_PROVIDER', 'mock'),
authJwtIssuer: envString('AUTH_JWT_ISSUER', ''),
authJwtAudience: envString('AUTH_JWT_AUDIENCE', 'authenticated'),
authJwtSecret: envString('AUTH_JWT_SECRET', DEFAULT_AUTH_JWT_SECRET),
authJwtJwksUrl: envString('AUTH_JWT_JWKS_URL', ''),
authCodeTtlSeconds: envNumber('AUTH_CODE_TTL_SECONDS', 300),
authSmsCooldownSeconds: envNumber('AUTH_SMS_COOLDOWN_SECONDS', 60),
authSessionTtlSeconds: envNumber('AUTH_SESSION_TTL_SECONDS', 60 * 60 * 24 * 7),